CN115424278A

CN115424278A - Mail detection method and device and electronic equipment

Info

Publication number: CN115424278A
Application number: CN202210969051.XA
Authority: CN
Inventors: 熊子晗; 陈军; 陈大北; 郭雪松
Original assignee: China Telecom Corp Ltd
Current assignee: China Telecom Corp Ltd
Priority date: 2022-08-12
Filing date: 2022-08-12
Publication date: 2022-12-02
Anticipated expiration: 2042-08-12
Also published as: CN115424278B

Abstract

The disclosed embodiment relates to a mail detection method, a device and an electronic device, relating to the technical field of network security, wherein the method comprises the following steps: converting a target text in the mail to be processed to obtain a mail characteristic image; performing image enhancement operation on the mail characteristic image to obtain an enhanced mail characteristic image; extracting the features of the enhanced mail feature image to obtain an output header feature vector; and fitting the output header characteristic vector to obtain a classification predicted value, and determining whether the mail to be processed is an abnormal mail according to the classification predicted value and a comparison result of a classification threshold value. The method and the device can accurately identify the abnormal mails on the basis of protecting the privacy of the user.

Description

Mail detection method and device and electronic equipment

Technical Field

The embodiment of the disclosure relates to the technical field of network security, and in particular relates to a mail detection method, a mail detection device and electronic equipment.

Background

Network attack events often acquire the identity of a user and other relevant data in a mail attack.

In the related technology, the existing meanings of words and the corresponding weights of the words can be detected by analyzing the contents of a sender mailbox, a text and the like, and the meanings and the corresponding weights of the words are used as the characteristics for representing the e-mail in the classifier, so that the neural network is used for judging the characteristics, detecting the phishing mail sample in the characteristics and finishing the classification task. In the mode, the problem of exposing privacy information such as mail senders, text contents and the like exists, the safety is poor, and the reliability is low; and, mail detection accuracy is low.

It is noted that the information of the invention in the above background section is only for enhancement of understanding of the background of the present disclosure and therefore may include information that does not constitute prior art that is already known to a person of ordinary skill in the art.

Disclosure of Invention

The present disclosure is directed to a mail detection method, a mail detection apparatus, and an electronic device, which overcome the problems of low security and poor accuracy due to the limitations and disadvantages of the related art, at least to some extent.

According to an aspect of the present disclosure, there is provided a mail detection method including: converting a target text in the mail to be processed to obtain a mail characteristic image; performing image enhancement operation on the mail characteristic image to obtain an enhanced mail characteristic image; extracting the features of the enhanced mail feature image to obtain an output header feature vector; and fitting the output header characteristic vector to obtain a classification predicted value, and determining whether the mail to be processed is an abnormal mail according to the classification predicted value and a comparison result of a classification threshold value.

In an exemplary embodiment of the present disclosure, the converting a target text in an email to be processed to obtain an email feature image includes: performing word segmentation operation on a target text to obtain a plurality of segmented words, and acquiring a feature vector of each segmented word and a weight of each segmented word; determining a hash coding value sequence corresponding to each feature vector; combining each bit of each hash code value in the hash code value sequence and the weight of the feature vector to generate a signature result; and performing image pixel point drawing operation on the signature result to determine the coordinates and gray values of pixel points so as to generate the mail characteristic image.

In an exemplary embodiment of the present disclosure, the determining a hash code value sequence corresponding to each feature vector includes: and randomly initializing a plurality of hash functions, and determining a hash code value sequence corresponding to each feature vector through the plurality of hash functions.

In an exemplary embodiment of the disclosure, the combining, in the sequence of hash-coded values, each bit of each hash-coded value and a weight of the feature vector to generate a signature result includes: performing logic operation according to the hash code value of each bit and the weight to generate a new hash code value sequence; performing row-column addition operation on the new hash coding value sequence to obtain a new hash vector; and judging binary values in the new hash vector according to bits to calculate a signature result.

In an exemplary embodiment of the present disclosure, the performing an image pixel point drawing operation on the signature result to determine coordinates and a gray value of a pixel point corresponding to each participle to generate the mail feature image includes: splitting a signature result into a first numerical value and a second numerical value; judging the comparison result of the first numerical value and the second numerical value with the threshold parameter according to the position to obtain a third numerical value and a fourth numerical value; and converting the third numerical value and the fourth numerical value into decimal numerical values to determine coordinates, and increasing the gray value of the pixel point at the coordinates by a preset value.

In an exemplary embodiment of the disclosure, the performing an image enhancement operation on the mail feature image to obtain an enhanced mail feature image includes: carrying out pixel inversion on the enhanced mail characteristic image, and replacing the gray value by a complementary gray value; and carrying out normalization processing on the complementary gray values of the pixel points so as to enhance the mail characteristic image.

In an exemplary embodiment of the disclosure, the performing feature extraction on the enhanced email feature image to obtain an output header feature vector includes: performing feature extraction and decoding on the enhanced mail feature image through a multi-stage model, and acquiring a decoded feature vector as an output header feature vector; the multi-stage model is obtained by connecting a plurality of target models in series, and the target models comprise a window multi-head attention layer and a shift window multi-head self-attention layer.

In an exemplary embodiment of the disclosure, the performing feature extraction and decoding on the enhanced mail feature image through a multi-stage model, and acquiring a decoded feature vector as an output header feature vector includes: carrying out region division on the enhanced mail feature image, and carrying out feature extraction on a division result through a linear embedding layer and a target model in a first-stage model to obtain initial features; the mail characteristic image is subjected to down-sampling, and depth characteristic extraction is carried out on the down-sampling result through a target model in a second-stage model, so that depth characteristics are obtained; and decoding the depth features through a target model in the third-stage model, and acquiring decoded feature vectors as output head feature vectors.

According to an aspect of the present disclosure, there is provided a mail detection apparatus including: the text conversion module is used for converting a target text in the mail to be processed to obtain a mail characteristic image; the image enhancement module is used for carrying out image enhancement operation on the mail characteristic image so as to obtain an enhanced mail characteristic image; the characteristic acquisition module is used for extracting the characteristics of the enhanced mail characteristic image to acquire an output header characteristic vector; and the mail identification module is used for fitting the characteristic vector of the output head to obtain a classification predicted value and determining whether the mail to be processed is an abnormal mail or not according to the classification predicted value and a comparison result of a classification threshold value.

According to an aspect of the present disclosure, there is provided an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above mail detection methods via execution of the executable instructions.

In the mail detection method, the mail detection device and the electronic equipment provided in the embodiment of the disclosure, on one hand, the character features of the target text in the mail to be processed are recoded into the mail feature image by using the dimension reduction algorithm, and the detection of the text features is converted into the detection of the image features, so that the text information of the mail to be processed is protected in the detection process, the safety and the reliability are improved, and the user privacy is protected. On the other hand, the abnormal mail detection is realized by detecting the image characteristics, so that the detection accuracy of the abnormal mail can be ensured on the basis of protecting the privacy of the user.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and together with the description, serve to explain the principles of the disclosure. It is to be understood that the drawings in the following description are merely exemplary of the disclosure, and that other drawings may be derived from those drawings by one of ordinary skill in the art without the exercise of inventive faculty.

Fig. 1 schematically shows a flowchart of a mail detection method according to an embodiment of the present disclosure.

Fig. 2 schematically illustrates a flow chart of converting to a mail feature image according to an embodiment of the present disclosure.

Fig. 3 schematically illustrates a schematic diagram of text conversion of an embodiment of the present disclosure.

Fig. 4 schematically illustrates a detailed flowchart of generating a mail feature image according to an embodiment of the present disclosure.

Fig. 5 schematically illustrates a schematic diagram of a feature extraction module according to an embodiment of the disclosure.

Fig. 6 schematically shows a structural diagram of a target model according to an embodiment of the disclosure.

Fig. 7 schematically illustrates a flow chart of mail detection according to an embodiment of the present disclosure.

Fig. 8 schematically shows a block diagram of a mail detection apparatus according to an embodiment of the present disclosure.

Fig. 9 schematically illustrates a block diagram of an electronic device according to an embodiment of the disclosure.

Detailed Description

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, components, devices, steps, and the like. In other instances, well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.

Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repetitive description will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.

In the related technology, the detection method of the mail has the problem of exposing privacy information such as a mail sender, text content and the like, an attacker may construct a hash algorithm through a random language model, and presume the original document content through a word frequency attack and other methods, so that sensitive information leakage and other problems are easily caused.

In order to solve the problems in the related art, in the embodiments of the present disclosure, a mail detection method is provided. Referring to fig. 1, the mail detection method mainly includes the following steps:

step S110, converting a target text in the mail to be processed to obtain a mail characteristic image;

step S120, carrying out image enhancement operation on the mail characteristic image to obtain an enhanced mail characteristic image;

step S130, extracting the characteristics of the enhanced mail characteristic image to obtain an output header characteristic vector;

and step S140, fitting the output header feature vector to obtain a classification predicted value, and determining whether the mail to be processed is an abnormal mail according to the classification predicted value and a comparison result of a classification threshold value.

In the embodiment of the disclosure, the character features of the target text in the mail to be processed are recoded into the mail feature image by using the dimension reduction algorithm, the mail feature image is subjected to image enhancement to obtain the enhanced mail feature image and obtain the output header feature vector, the classification predicted value is obtained based on the output header feature vector to identify the mail to be processed, the detection of the text features is converted into the detection of the image features, the text information of the mail to be processed is protected in the detection process, the safety and the reliability are improved, and the user privacy is protected. On the other hand, the abnormal mail detection is realized by detecting the image characteristics, so that the detection accuracy of the abnormal mail can be ensured on the basis of protecting the privacy of the user.

Next, each step of the mail detection method will be described in detail with reference to fig. 1.

In step S110, the target text in the mail to be processed is converted to obtain a mail feature image.

In the embodiment of the present disclosure, the to-be-processed mails may be to-be-detected mails received by all types of mailboxes. The mail to be processed may include text information, image information, and the like, and is not limited herein. For example, the sender and the receiver of the mail to be processed may correspond to text information; the text information may include text information or image information. Based on this, the target text may be all of the text information in the sender and body information. The mail characteristic image may be an image obtained by converting a target text in the mail, and one mail to be processed may correspond to one mail characteristic image. The mail feature image here may be a grayscale image.

Fig. 2 schematically shows a flowchart for converting a target text into a mail feature image, and referring to fig. 2, the method mainly includes the following steps: the method comprises the steps of obtaining a mail sample to obtain feature vector expression and weight, initializing a hash function, calculating a hash code value, obtaining a Simhash binary signature and drawing points by picture pixels. The specific introduction is as follows:

in step S210, a plurality of segmented words are obtained by performing filtering and word segmentation operations on the target text, and a feature vector and a weight of each segmented word are obtained.

In this step, after the mail to be processed is obtained, the sender and the text part of the text in the mail to be processed can be analyzed to be used as the target text. Further, the target text may be filtered, and a word segmentation operation is performed on the filtered target text to obtain a plurality of word segments, for example, t word segments. And a feature vector of each segmented word can be obtained, and the feature vector can be a distributed expression of a word corresponding to each segmented word. Because each word corresponds to a feature vector, a plurality of words obtained by segmenting the target text of the mail to be processed can form a feature vector sequence, and can be represented as the following form T _i ∈{T ₁ ,T ₂ ,...,T _t }。

At the same time, the weight of each participle can also be calculated, where the weight refers to the weight score, which can be expressed as w, for example _i . Examples of the inventionIllustratively, each participle weight score may be calculated using the Term Frequency-Inverse file Frequency TF-IDF (Term Frequency-Inverse Document Frequency) algorithm. Other ways of calculating the weight score of each participle may be used, and are not limited herein.

In step S220, a hash code value sequence corresponding to each feature vector is determined.

In this step, each word segmentation may correspond to a feature vector, and each feature vector may correspond to a hash code value sequence. The sequence of hash-coded values may be a sequence of binary hash-coded values. For example, a plurality of hash functions may be randomly initialized, and a hash code value sequence corresponding to each feature vector in the feature vector sequence may be determined by the plurality of hash functions. Namely, an n-dimensional hash code value corresponding to the feature vector of a participle is calculated through a hash function, so as to obtain a hash code value sequence of each participle.

In some embodiments, the hash function is used to obtain the features of each feature vector in one dimension, and the features of each feature vector in multiple dimensions can be obtained through multiple hash functions, so as to form a two-level hash code value sequence of each feature vector. The number of hash code values included in the hash code value sequence is the same as the number of hash functions.

Illustratively, n Hash functions Hash are initialized randomly _j ∈{Hash ₁ ,Hash ₂ ,...,Hash _n Using Hash function Hash _j Obtaining a feature vector T _i Features in the j-th dimension. Computing a feature vector T by a hash function _i Corresponding binary hash code value sequence H _j ∈{H ₁ ,H ₂ ,...,H _n }。

In step S230, combining each bit of each hash code value in the hash code value sequence and the weight of the feature vector to generate a signature result.

In this step, each hash code value may include multiple bits, and the value of each bit may be the same or different, for example, the value of the first bit may be 0, the value of the second bit may be 1, and so on. Based on this, the value of each bit in the hash code value and the weight of the feature vector of each participle may be combined to generate a signature result. The logic operation may be a weighted calculation or a subtraction calculation, which is determined according to the value of each bit. For example, if the value of the target bit in the hash code value is a first preset value, the value of the target bit and the weight of the eigenvector may be weighted; if the value of the target bit in the hash code value is not the first predetermined value, the value of the target bit and the weight of the feature vector may be subtracted to obtain a new hash code value sequence. The first preset value may be 1.

I.e. encoding the value H according to a hash _j Each bit of (a) is subjected to weighted calculation, the hash code value H _j The number of bits in 1, plus the weight w corresponding to the feature vector _i Otherwise, subtract its corresponding weight w _i At this time, a new hash code value sequence H 'subjected to weighted calculation can be obtained' _j ∈{H' ₁ ,H' ₂ ,...,H' _n }。

After obtaining the new sequence of hash code values, row and column addition operations may be performed on the new sequence of hash code values to obtain a new hash vector

The column addition operation refers to adding all hash code values in the new hash code value sequence to obtain a new hash vector corresponding to each feature vector.

Further, binary values in the new hash vector are judged according to bits, and a signature result is calculated by using a signal activation function. The signature result may be a Simhash binary signature result, which is used to represent the signature of each bit in the new hash vector. Illustratively, if the value of the target bit in the new hash vector is greater than a second preset value, the signature result of the marked target bit is 1, otherwise, the signature result is 0. The second preset value may be 0. For example, if the jth bit in the new hash vector is greater than 0, the tag Simhash signature has a jth bit of 1, otherwise it is 0.

In step S240, a pixel point tracing operation is performed on the signature result to determine coordinates and gray values of pixel points, so as to generate the mail feature image.

In this step, generating the mail feature image may include the steps of:

splitting a signature result into a first numerical value and a second numerical value;

judging the comparison result of the first numerical value and the second numerical value with the threshold parameter according to the position to obtain a third numerical value and a fourth numerical value;

and converting the third numerical value and the fourth numerical value into decimal numerical values to determine coordinates, and increasing the gray value of the pixel point at the coordinates by a preset value.

The first value and the second value may be 8-bit 16-ary values. The third value may be a value obtained by converting the first value, and the fourth value may be a value obtained by converting the second value. Both the third value and the fourth value may be 8-bit binary values. The third numerical value and the fourth numerical value can be further converted into two decimal numerical values which are respectively recorded as horizontal and vertical coordinates of the pixel point, and the gray value g of the pixel point at the coordinate is increased by a preset value. The preset value may be 16.

In some embodiments, the Simhash binary signature result is split into two 8-bit 16-ary values Sim ₁ And Sim ₂ And comparing the 16-system numerical value with the threshold parameter according to the bit to obtain a comparison result. The threshold parameter may be 7. If the comparison result shows that the first numerical value and the second numerical value are larger than 7, the digit larger than 7 is marked as 1, otherwise, the digit is marked as 0. Based thereon, two 8-bit binary values, i.e. a third value Sim' ₁ And a fourth value Sim' ₂ . Providing a third value of Sim' ₁ And a fourth value Sim' ₂ Conversion to decimal value X _sim ∈[0,255]And Y _sim ∈[0,255]The coordinates may be determined from the decimal value. In particular, the decimal value X _sim ∈[0,255]Determining the decimal value Y as abscissa _sim ∈[0,255]Determined as the ordinate. And coordinate (X) _sim ，Y _sim ) And marking the image, and increasing the gray value of the pixel point at the coordinate by 16 until the gray value reaches a target value. The target value may be a maximum gray value, for example 255. Illustratively, the gray value of the pixel point of each coordinate isA preset value of 16 may be added, and if the gray value of a pixel point at a certain coordinate is greater than 255 after the preset value is added, the gray value is determined to be 255. And if the gray value of the pixel point at a certain coordinate is not greater than 255 after being increased by the preset value, determining the gray value as the gray value after the preset value is increased. It should be noted that the gray value of the default pixel point is 0.

And repeatedly executing the processes of calculating the Hash code value sequence, obtaining the signature result and performing pixel point tracing operation on the image until the pixel point tracing operation is finished for all the participles so as to convert the target text of the mail to be processed into a mail characteristic image. The mail feature image may be 265 x 265 image. The specific process is shown in fig. 3.

Fig. 3 schematically illustrates a process of processing a segmented word text, where feature vectors and weights of the feature vectors are extracted from the obtained segmented words, and hash values of the feature vectors in n dimensions are determined by a hash function, where the weights corresponding to the hash values in n different dimensions are the same. Each hash value can contain multiple bits, different modes and weight weighting calculation of the eigenvector are selected according to whether the numerical value of each bit is the first preset value 1, a new numerical value is obtained and spliced to obtain a new hash code value sequence as a weighting result, and the new hash vector is obtained by row and column addition on the weighting result. Further, the binary number value in the new hash vector is subjected to signature calculation by using a signal activation function, and a signature result is obtained. The signature result may be a binary value. And splitting the Simhash binary signature result into two 8-bit 16-system numerical values, and comparing the 16-system numerical values with the threshold parameter according to bits to obtain a comparison result. If the comparison result is more than 7, the digit more than 7 is marked as 1, otherwise, the digit is marked as 0. Based on which two 8-bit binary values are obtained. Further converting the two 8-bit binary values into decimal values, the abscissa and ordinate can be determined from the decimal values to determine the coordinates. Based on this, pixel plotting is performed based on the coordinates.

Fig. 4 schematically shows a flowchart for generating a mail feature image, and referring to fig. 4, the mail 401 to be processed may be parsed to obtain a target text represented by a sender and a body. And performing word segmentation on the target text to obtain a feature vector and weight, initializing a hash function, calculating a hash code value, and obtaining a binary signature result. And performing image pixel point drawing based on the signature result to obtain a mail characteristic image 402.

According to the method and the device, the target text of the mail to be processed is converted into the mail characteristic image, so that the safety can be improved, and the privacy of a user can be protected.

Next, with continued reference to fig. 1, in step S120, the mail feature image is subjected to an image enhancement operation to obtain an enhanced mail feature image.

In the embodiment of the disclosure, the mail image enhancement module is mainly used for performing image enhancement operation on the generated mail image characteristics, reducing noise interference and enhancing pixel point characteristics of the mail image characteristics. The method comprises the following specific steps: carrying out pixel inversion on the mail characteristic image, and replacing the gray value by a complementary gray value; and carrying out normalization processing on the complementary gray values of the pixel points so as to enhance the mail characteristic image. Pixel inversion refers to replacing the gray value by a complementary gray value opposite to the gray value at the coordinates. The complementary gradation value g' may be determined by the difference between the target value and the gradation value. The target value may be 255. On this basis, complementary gray values can be determined by g' =255-g to perform image pixel inversion changes, aiming at replacing the original gray values with complementary gray values. And after the image pixels are inverted, converting the original black background into a white background, and meanwhile, enhancing the gray details of the original pixel points.

After the pixel inversion is carried out, normalization processing can be carried out on the mail characteristic image by carrying out normalization processing on the complementary gray value of the pixel point. Illustratively, the minimum value g of the pixel point can be based on _min And maximum value g _max Performing logical operation to realize normalization processing, specifically as shown in formula (1):

and K is a scale factor and is determined according to actual requirements.

The image pixel inversion change and the image normalization process aim at enhancing the pixel point characteristics of the mail characteristic image and enhancing the image contrast, thereby enhancing the image characteristics and reducing the noise interference of the image.

In step S130, feature extraction is performed on the enhanced mail feature image, and an output header feature vector is obtained.

In the embodiment of the disclosure, feature extraction may be performed on the enhanced mail feature image through a feature extraction module. Referring to fig. 5, the feature extraction module may include a zoning layer 501, a multi-stage model 502, and a global pooling layer 503, the multi-stage model 502 including a first stage model 5021, a second stage model 5022, and a third stage model 5023. The multi-stage models each include a plurality of object models 504, and the number of object models included in the models of different nodes may be the same or different. The target model 504 may be a Swin transform model, which includes a window multi-head attention layer and a shift window multi-head self-attention layer. Referring to fig. 6, the target model Swin transformer has two subunits. Each subunit consists of a regularization layer, an attention module, another regularization layer, a feedforward neural network layer and a residual error network. The regularization layer may be an LN regularization layer. The attention module of the first unit uses W-MSA and the attention module of the second unit uses SW-MSA. The W-MSA based on the mobile window and the SW-MSA based on the window are connected in front and back, and the transfer and interaction of features in different windows are realized.

In a windowed multi-headed attention layer, attention is only calculated within each window. After the non-overlapping windows are adopted, each self-attention operation is carried out in the small window, the patch in each window can never notice the information of the patches in other windows, namely the information between the windows is not interacted, so that the receptive field of the whole model can be limited, the receptive field can be limited in the windows, and the global information can not be seen.

The modeling capability of the network is limited by limiting attention to each window. To address this problem, swin Transformer uses a shifted window SW-MSA model after the W-MSA model. The window is moved by half the distance of the window from the original window to the lower right corner, and the multi-head self-attention based on the window is firstly performed and then performed once again, so that the mutual communication between the window and the window is realized.

Based on the structure of the feature extraction model, the process of extracting and decoding features of the enhanced mail feature image can refer to the process shown in fig. 5:

the enhanced mail feature image can be processed through a first-stage model, specifically, regions are divided through a region dividing layer, and a dividing result is input into a linear embedding layer and a 2-layer Swin transform model in the first-stage model to perform first-layer feature extraction, so that initial features are obtained. And further processing by a second-stage model, and specifically, performing feature extraction on the initial features output by the first-stage model according to the region fusion layer in the second-stage model and the 4-layer Swin Transformer model. Exemplarily, downsampling an input image through a region fusion operation performed by a region fusion layer, performing depth feature extraction on initial features by using a 4-layer Swin transform model to obtain local features and enable the local features to have a global receptive field, and determining the local features as depth features according to the local features with the global receptive field. The local features in the image are further deepened through the second-stage model, all the local features are associated, the local features have a global receptive field, and accuracy and comprehensiveness of the depth features are improved. The 4-layer Swin Transformer model can be obtained by connecting the 2-window multi-head self-attention layer W-MSA and the shift-window multi-head self-attention layer SW-MSA in series. Next, processing may be performed through the third-stage model, specifically, decoding is performed on the depth features output by the second-stage model according to the region fusion layer and the 2-layer Swin Transformer model in the third-stage model, and the decoded feature vector is obtained based on the global pooling layer, so as to obtain the output header feature vector.

In the embodiment of the disclosure, the accuracy and the comprehensiveness of the obtained feature vector can be improved by connecting a plurality of stage models in series.

Referring to the block diagram of the object model shown in fig. 6, the object model includes a window multi-head attention layer and a shift window multi-head self-attention layer. Among other things, a regularization layer, residual connection, and feed-forward neural network are included. The specific process is as follows: normalizing the input features through a regularization layer, and changing each row into a normalization result with the mean value of 0 and the variance of 1; and (4) performing characteristic learning on the normalized result through the W-MSA, and performing residual connection through a residual network. The input features here are determined according to the different phase models in which the object model is located. And then obtaining the output characteristics of the layer through an LN regularization layer, a feedforward neural network and a residual error network. Further, the multi-headed self-attentive Shifted window based on the moving window is performed on the output features to obtain an output of the object model. Specifically, output characteristics are normalized through a regularization layer to obtain a normalization result; and the multi-head self-attention layer SW-MSA passing through the mobile window performs characteristic learning on the normalized result, and performs residual connection through a residual network. And finally obtaining the final output of a target model through an LN regularization layer, a feedforward neural network and a residual error network.

In the embodiment of the disclosure, in order to ensure that there is a relation between non-overlapping windows, a multi-head self-attention layer of a moving window is adopted to recalculate the self-attention after a window shift. The moving window is to move the original window to the lower right corner by half the distance of the window, and the multi-head self-attention based on the window is firstly performed each time, and then the multi-head self-attention based on the moving window is performed again, so that the mutual communication between the window and the window is achieved, the complexity is reduced, the local feature with the global receptive field can be extracted as the depth feature, and the accuracy of the feature vector is improved.

It is necessary to supplement that, a two-classification cross entropy loss function can be used as a loss function of the multi-stage model, and model parameters of the multi-stage model are updated until the loss function converges, so as to perform model training and improve the accuracy and robustness of the model.

In step S140, the output header feature vector is fitted to obtain a classification predicted value, and whether the mail to be processed is an abnormal mail is determined according to a comparison result between the classification predicted value and a classification threshold.

In the embodiment of the disclosure, after the output head feature vector is obtained, fitting prediction may be performed on the output head feature vector to obtain a classification prediction value. Illustratively, the output header feature vector may be input to the linear connection layer and the full connection layer to perform linear connection and full connection processing on the output header feature vector, and a sigmoid function is used to obtain the classification prediction value.

After the classification predicted value is obtained, the classification predicted value can be compared with a classification threshold value to obtain a comparison result, and whether the mail to be processed is an abnormal mail or not is determined according to the comparison result. The classification threshold may be defined according to actual requirements, and may be a, for example. If the comparison result is that the classification predicted value is larger than the classification threshold value, determining that the mail to be processed belongs to an abnormal mail; and if the comparison result is that the classification predicted value is smaller than the classification threshold value, determining that the mail to be processed does not belong to the abnormal mail, namely, the mail belongs to the normal mail. The abnormal mail may be a dangerous mail such as a phishing mail. The abnormal mail may be a phishing mail or other type of risky mail. For example, the method can be used for deceiving a receiver to reply information such as an account number, a password and the like to a specified receiver by using a fake email; or to direct the recipient to connect to a mail disguised as a web page tailored to the real web site.

In addition, if the mail to be processed is an abnormal mail, the risk is considered to exist, and early warning can be provided so as to be convenient for a user to avoid.

Fig. 7 schematically shows a detailed flowchart of mail detection, and referring to fig. 7, the method mainly includes the following steps:

in step S710, a mail to be processed is acquired. The mail to be processed may be some unknown external mail received in the mailbox.

In step S720, the mail to be processed is subjected to feature conversion to obtain a mail feature image.

Exemplarily, mainly comprising the steps of: analyzing the sender information and the text information of the mail sample, performing word segmentation operation on the text information, calculating the weight of each word segmentation, and simultaneously obtaining the feature vector expression of each word segmentation. N hash functions are randomly initialized to obtain a sequence of hash encoded values. And acquiring a Simhash binary signature result. And performing pixel point drawing operation according to the signature result to obtain a mail feature image of 265 × 265.

In step S730, a mail feature image is obtained.

In step S740, feature enhancement is performed on the mail feature image.

Illustratively, the mail feature image may be subjected to image pixel flipping and normalization, resulting in an enhanced mail feature image.

In step S750, feature extraction and decoding are performed on the enhanced email feature image to obtain an output header feature vector.

For example, the enhanced mail feature image may be divided into regions, feature extraction is performed through a target model in a multi-stage model, feature decoding is performed, and a decoded feature vector is obtained through a global pooling layer and is used as an output header feature vector.

The characteristic extraction module comprises a region division module, 3 stage models and 1 output head, wherein the 3 stage models comprise (2, 4, 2) layers of Swin transform modules which are connected in series. The neural networks of the window multi-head self-attention layer and the shift window multi-head self-attention layer are serially designed into a 2-layer Swin transform module.

Based on the above, the enhanced mail feature image is subjected to region division, and then the enhanced mail feature image is input into the 1 st stage model for feature extraction. The phase 1 model includes a linear embedding layer and a 2-layer Swin transform module. Then, the depth features of the image are further extracted by using the 2 nd-stage model, and the local features in the image are further deepened to have a global receptive field. The 2 nd stage model comprises a region fusion layer and a 4-layer Swin Transformer model, wherein the region fusion layer performs down-sampling on the image, and the 4-layer Swin Transformer model is formed by connecting 2W-MSAs and 2 SW-MSAs in series. Finally, the 3 rd stage model carries out the decoding operation of the characteristics. The 3 rd stage model comprises a zone fusion layer and a 2-layer Swin transform model. And after the 3-stage model processing is finished, obtaining a decoded feature vector as an output header feature vector through a global pooling layer.

In step S760, the output header feature vector is subjected to feature classification, and the type of the mail to be processed is determined.

Exemplarily, a sigmoid function is used for obtaining a classification predicted value of the output head feature vector, the classification predicted value is compared with a classification threshold value to obtain a comparison result, and whether the mail to be processed belongs to an abnormal mail or a normal mail is judged according to the comparison result.

In step S770, an abnormal mail is identified.

According to the technical scheme provided by the embodiment of the disclosure, aiming at the problem that privacy information such as mail senders, text content and the like is exposed in the existing mail detection method, an abnormal mail detection flow based on privacy protection is constructed, and the text features are recoded into gray images by using a dimension reduction algorithm, so that the original text features are converted into image features, the mail detection task is also changed into an image classification task, the irreversibility of the conversion process is utilized to prevent an attacker from reversing, and the privacy protection of sensitive information of a user mail in the detection process is realized. The method has the advantages that the Swin-transformer algorithm is utilized to realize mail detection based on image features, and the detection accuracy of the mail can be guaranteed on the basis of protecting the privacy of users.

The present disclosure also provides a mail detection device. Referring to fig. 8, the mail detection method 800 mainly includes the following modules:

the text conversion module 801 is used for converting a target text in the mail to be processed to obtain a mail characteristic image;

an image enhancement module 802, configured to perform an image enhancement operation on the email feature image to obtain an enhanced email feature image;

a feature obtaining module 803, configured to perform feature extraction on the enhanced email feature image, and obtain an output header feature vector;

and the mail identification module 804 is configured to fit the output header feature vector to obtain a classification predicted value, and determine whether the mail to be processed is an abnormal mail according to a comparison result between the classification predicted value and a classification threshold.

In an exemplary embodiment of the present disclosure, the converting a target text in a mail to be processed to obtain a mail feature image includes: performing word segmentation operation on a target text to obtain a plurality of segmented words, and acquiring a feature vector of each segmented word and a weight of each segmented word; determining a hash coding value sequence corresponding to each feature vector; combining each bit of each hash code value in the hash code value sequence and the weight of the feature vector to generate a signature result; and performing image pixel point drawing operation on the signature result to determine the coordinates and gray values of pixel points so as to generate the mail characteristic image.

In an exemplary embodiment of the present disclosure, the performing an image pixel point-tracing operation on the signature result to determine coordinates and a gray value of a pixel point corresponding to each participle to generate the mail feature image includes: splitting a signature result into a first numerical value and a second numerical value; judging the comparison result of the first numerical value and the second numerical value with the threshold parameter according to the position to obtain a third numerical value and a fourth numerical value; and converting the third numerical value and the fourth numerical value into decimal numerical values to determine coordinates, and increasing the gray value of the pixel point at the coordinates by a preset value.

In an exemplary embodiment of the present disclosure, the performing an image enhancement operation on the mail feature image to obtain an enhanced mail feature image includes: carrying out pixel inversion on the mail characteristic image, and replacing the gray value by a complementary gray value; and carrying out normalization processing on the complementary gray values of the pixel points so as to enhance the mail characteristic image.

In an exemplary embodiment of the present disclosure, the performing feature extraction on the enhanced email feature image to obtain an output header feature vector includes: performing feature extraction on the enhanced mail feature image through a multi-stage model to obtain depth features, decoding the depth features, and obtaining decoded feature vectors as output header feature vectors; the multi-stage model is obtained by connecting a plurality of target models in series, and each target model comprises a window multi-head attention layer and a shift window multi-head self-attention layer.

In an exemplary embodiment of the disclosure, the performing feature extraction and decoding on the enhanced mail feature image through a multi-stage model, and acquiring a decoded feature vector as an output header feature vector includes: performing region division on the mail characteristic image, and performing characteristic extraction on a division result through a linear embedding layer and a target model in a first-stage model to obtain initial characteristics; performing depth feature extraction on the initial features through a target model in the second-stage model to obtain depth features; and decoding the depth features through a target model in the third-stage model, and acquiring decoded feature vectors as output head feature vectors.

It should be noted that the specific details of each module in the above-mentioned mail detection apparatus have been described in detail in the corresponding mail detection method, and therefore are not described herein again.

It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.

Moreover, although the steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that the steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.

In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

As will be appreciated by one skilled in the art, aspects of the present disclosure may be embodied as a system, method or program product. Accordingly, various aspects of the disclosure may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.

An electronic device 900 according to this embodiment of the disclosure is described below with reference to fig. 9. The electronic device 900 shown in fig. 9 is only an example and should not bring any limitations to the functionality or scope of use of the embodiments of the present disclosure.

As shown in fig. 9, electronic device 900 is in the form of a general purpose computing device. Components of electronic device 900 may include, but are not limited to: the at least one processing unit 910, the at least one storage unit 920, a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910), and a display unit 940.

Wherein the storage unit stores program code that is executable by the processing unit 910 to cause the processing unit 910 to perform steps according to various exemplary embodiments of the present disclosure described in the above section "exemplary method" of the present specification. For example, the processing unit 910 may perform the steps as shown in fig. 2.

The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and/or a cache storage unit 9202, and may further include a read only storage unit (ROM) 9203.

Storage unit 920 may also include a program/utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment.

Bus 930 can be any type representing one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 900, and/or with any device (e.g., router, modem, etc.) that enables the electronic device 900 to communicate with one or more other computing devices. Such communication may occur via input/output (I/O) interface 950. Also, the electronic device 900 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network such as the Internet) via the network adapter 960. As shown, the network adapter 960 communicates with the other modules of the electronic device 900 via the bus 930. It should be appreciated that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or an electronic device, etc.) to execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, there is also provided a computer readable storage medium having stored thereon a program product capable of implementing the above-described method of the present specification. In some possible embodiments, various aspects of the disclosure may also be implemented in the form of a program product comprising program code for causing a terminal device to perform the steps according to various exemplary embodiments of the disclosure described in the "exemplary methods" section above of this specification, when the program product is run on the terminal device.

The program product for implementing the above method according to the embodiments of the present disclosure may employ a portable compact disc read only memory (CD-ROM) and include program codes, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

A computer readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

Furthermore, the above-described figures are merely schematic illustrations of processes included in methods according to exemplary embodiments of the present disclosure, and are not intended to be limiting. It will be readily appreciated that the processes illustrated in the above figures are not intended to indicate or limit the temporal order of the processes. In addition, it is also readily understood that these processes may be performed, for example, synchronously or asynchronously in multiple modules.

Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. A method for mail detection, comprising:

converting a target text in the mail to be processed to obtain a mail characteristic image;

performing image enhancement operation on the mail characteristic image to obtain an enhanced mail characteristic image;

extracting the features of the enhanced mail feature image to obtain an output header feature vector;

and fitting the characteristic vector of the output header to obtain a classification predicted value, and determining whether the mail to be processed is an abnormal mail according to the classification predicted value and a comparison result of a classification threshold value.

2. The mail detection method of claim 1, wherein the converting the target text in the mail to be processed to obtain the mail feature image comprises:

performing word segmentation operation on a target text to obtain a plurality of segmented words, and acquiring a feature vector of each segmented word and a weight of each segmented word;

determining a hash coding value sequence corresponding to each feature vector;

combining each bit of each hash code value in the hash code value sequence with the weight of the feature vector corresponding to the participle to generate a signature result;

and performing image pixel point drawing operation on the signature result to determine the coordinates and the gray value of a pixel point so as to generate the mail characteristic image.

3. The method of claim 2, wherein the determining the sequence of hash code values corresponding to each eigenvector comprises:

and initializing a plurality of hash functions at random, and determining a hash code value sequence corresponding to each feature vector through the plurality of hash functions.

4. The method of claim 2, wherein the combining each bit of each hash code value in the sequence of hash code values with the weight of the feature vector corresponding to the participle to generate a signature result comprises:

performing logic operation according to the numerical value of each digit and the weight to generate a new hash coding value sequence;

performing row-column addition operation on the new hash coding value sequence to obtain a new hash vector;

and judging binary values in the new hash vector according to bits to calculate a signature result.

5. The mail detection method of claim 2, wherein the performing an image pixel dotting operation on the signature result to determine coordinates and gray values of pixel points corresponding to each participle to generate the mail feature image comprises:

and converting the third numerical value and the fourth numerical value into decimal numerical values to determine coordinates, and increasing the gray value of the pixel point at the coordinates by a preset value until the gray value reaches a target value to generate a mail characteristic image.

6. The mail detection method of claim 1, wherein the subjecting the mail characteristic image to an image enhancement operation to obtain an enhanced mail characteristic image comprises:

carrying out pixel inversion on the mail characteristic image, and replacing the gray value by a complementary gray value;

and carrying out normalization processing on the complementary gray values of the pixel points so as to enhance the mail characteristic image.

7. The mail detection method of claim 1, wherein the extracting the features of the enhanced mail feature image to obtain an output header feature vector comprises:

performing feature extraction on the enhanced mail feature image through a multi-stage model to obtain depth features, decoding the depth features, and obtaining decoded feature vectors as output header feature vectors;

the multi-stage model is obtained by connecting a plurality of target models in series, and each target model comprises a window multi-head attention layer and a shift window multi-head self-attention layer.

8. The mail detection method of claim 7, wherein the performing feature extraction and decoding on the enhanced mail feature image through a multi-stage model to obtain a decoded feature vector as an output header feature vector comprises:

carrying out region division on the enhanced mail feature image, and carrying out feature extraction on a division result through a linear embedding layer and a target model in a first-stage model to obtain initial features;

performing depth feature extraction on the initial features through a target model in a second-stage model to obtain depth features;

and decoding the depth features through a target model in the third-stage model, and acquiring decoded feature vectors as output head feature vectors.

9. A mail detection device, comprising:

the text conversion module is used for converting a target text in the mail to be processed to obtain a mail characteristic image;

the image enhancement module is used for carrying out image enhancement operation on the mail characteristic image so as to obtain the enhanced mail characteristic image;

the characteristic acquisition module is used for extracting the characteristics of the enhanced mail characteristic image and acquiring an output header characteristic vector;

and the mail identification module is used for fitting the output header characteristic vector to obtain a classification predicted value and determining whether the mail to be processed is an abnormal mail or not according to the classification predicted value and a comparison result of a classification threshold value.

10. An electronic device, comprising:

a processor; and

a memory for storing executable instructions of the processor;

wherein the processor is configured to perform the mail detection method of any of claims 1-8 via execution of the executable instructions.